FlawAtlas
Search the atlas
CVE-2022-1996 Critical

Authorization Bypass Through User-Controlled Key in emicklei/go-restful

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

Exploit probability 2.9%
Published June 6, 2022
Required by Not available
Last source change August 12, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

53 explicit affected versions

Go github.com/emicklei/go-restful
Go github.com/emicklei/go-restful/v2
Go github.com/emicklei/go-restful/v3
Go github.com/emicklei/go-restful
Go github.com/emicklei/go-restful/v2
Go github.com/emicklei/go-restful/v3

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2022-1996

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

View original source
Open Source Vulnerabilities GHSA-r48q-9g5r-8q2h

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

View original source
Open Source Vulnerabilities GO-2022-0619

CORS filters that use an AllowedDomains configuration parameter can match domains outside the specified set, permitting an attacker to avoid the CORS policy. The AllowedDomains configuration parameter is documented as a list of allowed origin domains, but values in this list are applied as regular expression matches. For example, an allowed domain of "example.com" will match the Origin header "example.com.malicious.domain".

View original source

05 / REFERENCES

Further evidence